CISA has recently added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These vulnerabilities are CVE-2026-5430, affecting WSO2 products, and CVE-2026-71362, impacting Adobe Commerce and Magento. Such vulnerabilities are commonly used by cyber actors and present substantial risks to federal systems. Binding Operational Directive 26-04 mandates that Federal Civilian Executive Branch agencies prioritize fixing these high-risk, exploited vulnerabilities on public-facing assets. This directive emphasizes rapid remediation of KEV Catalog entries that grant full control after exploitation. It also outlines requirements for agencies to check for compromises before applying patches. While BOD 26-04 specifically targets FCEB agencies, CISA advises all organizations to implement risk-based vulnerability management. Prioritizing the remediation of vulnerabilities listed in the KEV Catalog is strongly encouraged for all entities. CISA will continue to identify and add newly exploited vulnerabilities to the KEV Catalog. Organizations with information about exploited vulnerabilities not yet in the catalog are encouraged to submit them for consideration.